Liftings for Differential Privacy

Gilles Barthe (1) , Thomas Espitau (2) , Justin Hsu (3) , Tetsuya Sato (4) , Pierre-Yves Strub (1)

1 Institute IMDEA Software [Madrid]
2 ALMASTY - ALgorithms for coMmunicAtion SecuriTY
3 University of Pennsylvania
4 Research Institute for Mathematical Sciences, Kyoto University, Japan

Recent developments in formal verification have identified approximate liftings (also known as approximate couplings) as a clean, compositional abstraction for proving differential privacy. There are two styles of definitions for this construction. Earlier definitions require the existence of one or more witness distributions, while a recent definition by Sato uses universal quantification over all sets of samples. These notions have different strengths and weaknesses: the universal version is more general than the existential ones, but the existential versions enjoy more precise composition principles. We propose a novel, existential version of approximate lifting, called-lifting, and show that it is equivalent to Sato's construction for discrete probability measures. Our work unifies all known notions of approximate lifting, giving cleaner properties, more general constructions, and more precise composition theorems for both styles of lifting, enabling richer proofs of differential privacy. We also clarify the relation between existing definitions of approximate lifting, and generalize our constructions to approximate liftings based on f-divergences.

Mots clés: Differential Privacy; Probabilistic Couplings; Formal Verification

Domaines: Logique en informatique [cs.LO]; Langage de programmation [cs.PL]

Gilles Barthe, Thomas Espitau, Justin Hsu, Tetsuya Sato, Pierre-Yves Strub. Liftings for Differential Privacy. ICALP 2017, Jul 2017, Varsovie, Poland. ⟨10.4230/LIPIcs.ICALP.2017⟩. ⟨hal-01541197⟩